[PATCH RFC v3 75/90] net: add net_may()

[Josef Bacik <josef@toxicpanda.com>]

Almost every operation that changes a network namespace is guarded by the
same check: ns_capable(net->user_ns, CAP_NET_ADMIN). There are well over a
hundred of these checks. They cover devices, addresses, routes, netfilter,
traffic control, tunnels, IPsec, socket options and more.

The check does not say which of these it is guarding. So there is no way
to allow one kind of operation without allowing all of them. A program
that only needs to add a netfilter rule must be given the power to create
tunnels as well.

Add net_may(net, right). It asks whether the caller may do one particular
kind of thing to a network namespace, and enum net_right names the kinds.
For now the answer is the same as before: NET_RIGHT_RAW requires
CAP_NET_RAW over the owner of the namespace, and every other right
requires CAP_NET_ADMIN. A single function, net_right_ns(), makes that
decision, so a later patch can change it in one place.

Add a variant for each form the existing checks take:

  net_may_noaudit()   like ns_capable_noaudit()
  file_net_may()      like file_ns_capable(), for the opener of a file
  sockopt_net_may()   like sockopt_ns_capable(), which lets BPF set options
  netlink_net_may()   like netlink_ns_capable(), which checks both the
                      opener of the socket and the sender of the message

The rights follow the entry points, because most of the code in question
sits behind a handful of them. A right can be split later if its entry
point learns to distinguish more cases.

There are no users yet.

Signed-off-by: Josef Bacik <josef@toxicpanda.com>
---
 include/linux/netlink.h     |  2 ++
 include/net/net_namespace.h | 25 +++++++++++++++++++
 include/net/sock.h          |  1 +
 net/core/net_namespace.c    | 58 +++++++++++++++++++++++++++++++++++++++++++++
 net/core/sock.c             | 13 ++++++++++
 net/netlink/af_netlink.c    | 21 ++++++++++++++++
 6 files changed, 120 insertions(+)

diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 882e9c1b6c1d..16ecb55e9f12 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -10,6 +10,7 @@
 #include <uapi/linux/netlink.h>
 
 struct net;
+enum net_right;
 
 void do_trace_netlink_extack(const char *msg);
 
@@ -356,6 +357,7 @@ bool netlink_ns_capable(const struct sk_buff *skb,
 			struct user_namespace *ns, int cap);
 bool netlink_capable(const struct sk_buff *skb, int cap);
 bool netlink_net_capable(const struct sk_buff *skb, int cap);
+bool netlink_net_may(const struct sk_buff *skb, const struct net *net, enum net_right right);
 struct sk_buff *netlink_alloc_large_skb(unsigned int size, int broadcast);
 
 #endif	/* __LINUX_NETLINK_H */
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index c29a22ca178f..badee0bbc567 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -459,6 +459,31 @@ static inline struct net *read_pnet_rcu(const possible_net_t *pnet)
 #define __net_initconst	__initconst
 #endif
 
+/**
+ * enum net_right - what somebody wants to do to a network namespace
+ *
+ * Changing anything about a network namespace takes a capability over the user
+ * namespace that owns it, and nearly always that is CAP_NET_ADMIN, whatever it is
+ * that is to be changed. A check that goes by way of net_may() says what it is for.
+ */
+enum net_right {
+	NET_RIGHT_LINK,		/* change a device: up, down, mtu, name */
+	NET_RIGHT_LINK_NEW,	/* make and remove devices */
+	NET_RIGHT_ADDR,		/* addresses */
+	NET_RIGHT_ROUTE,	/* routes, rules, neighbours */
+	NET_RIGHT_FILTER,	/* netfilter */
+	NET_RIGHT_TC,		/* queueing disciplines, classes, filters */
+	NET_RIGHT_TUN,		/* make tun and tap devices */
+	NET_RIGHT_SYSCTL,	/* /proc/sys/net */
+	NET_RIGHT_SOCKOPT,	/* socket options that reach beyond the socket */
+	NET_RIGHT_RAW,		/* raw and packet sockets. This one is CAP_NET_RAW */
+	NET_RIGHT_NR
+};
+
+bool net_may(const struct net *net, enum net_right right);
+bool net_may_noaudit(const struct net *net, enum net_right right);
+bool file_net_may(const struct file *file, const struct net *net, enum net_right right);
+
 int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp);
 int peernet2id(const struct net *net, struct net *peer);
 bool peernet_has_id(const struct net *net, struct net *peer);
diff --git a/include/net/sock.h b/include/net/sock.h
index 173b37b2b8bb..7562a73ac29d 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1781,6 +1781,7 @@ static inline void unlock_sock_fast(struct sock *sk, bool slow)
 void sockopt_lock_sock(struct sock *sk);
 void sockopt_release_sock(struct sock *sk);
 bool sockopt_ns_capable(struct user_namespace *ns, int cap);
+bool sockopt_net_may(const struct sock *sk, enum net_right right);
 bool sockopt_capable(int cap);
 
 /* Used by processes to "lock" a socket state, so that
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 52c2bd44778a..d211631f8c42 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -362,6 +362,64 @@ int peernet2id(const struct net *net, struct net *peer)
 }
 EXPORT_SYMBOL(peernet2id);
 
+static int net_right_cap(enum net_right right)
+{
+	return right == NET_RIGHT_RAW ? CAP_NET_RAW : CAP_NET_ADMIN;
+}
+
+/* The user namespace over which @cred needs the capability. NULL: none will do. */
+static struct user_namespace *net_right_ns(const struct cred *cred, const struct net *net,
+					   enum net_right right)
+{
+	return net->user_ns;
+}
+
+/**
+ * net_may - may the caller do this to a network namespace?
+ * @net:   the network namespace
+ * @right: what it is that the caller wants to do
+ *
+ * Return: true if it may, which is noted as a use of privilege.
+ */
+bool net_may(const struct net *net, enum net_right right)
+{
+	struct user_namespace *ns = net_right_ns(current_cred(), net, right);
+
+	return ns && ns_capable(ns, net_right_cap(right));
+}
+EXPORT_SYMBOL_GPL(net_may);
+
+/**
+ * net_may_noaudit - the same, where a no is nothing to write home about
+ * @net:   the network namespace
+ * @right: what it is that the caller wants to do
+ *
+ * Return: true if it may.
+ */
+bool net_may_noaudit(const struct net *net, enum net_right right)
+{
+	struct user_namespace *ns = net_right_ns(current_cred(), net, right);
+
+	return ns && ns_capable_noaudit(ns, net_right_cap(right));
+}
+EXPORT_SYMBOL_GPL(net_may_noaudit);
+
+/**
+ * file_net_may - might whoever opened a file do this to a network namespace?
+ * @file:  the file
+ * @net:   the network namespace
+ * @right: what is to be done
+ *
+ * Return: true if it might, going by what it was when it opened @file.
+ */
+bool file_net_may(const struct file *file, const struct net *net, enum net_right right)
+{
+	struct user_namespace *ns = net_right_ns(file->f_cred, net, right);
+
+	return ns && file_ns_capable(file, ns, net_right_cap(right));
+}
+EXPORT_SYMBOL_GPL(file_net_may);
+
 /* This function returns true is the peer netns has an id assigned into the
  * current netns.
  */
diff --git a/net/core/sock.c b/net/core/sock.c
index cac93cba3c84..352310066e35 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1172,6 +1172,19 @@ bool sockopt_ns_capable(struct user_namespace *ns, int cap)
 }
 EXPORT_SYMBOL(sockopt_ns_capable);
 
+/**
+ * sockopt_net_may - net_may() over the network namespace of a socket, for an option
+ * @sk:    the socket
+ * @right: what the option comes to
+ *
+ * Return: true if the caller may, or if it is a BPF program that sets the option.
+ */
+bool sockopt_net_may(const struct sock *sk, enum net_right right)
+{
+	return has_current_bpf_ctx() || net_may(sock_net(sk), right);
+}
+EXPORT_SYMBOL(sockopt_net_may);
+
 bool sockopt_capable(int cap)
 {
 	return has_current_bpf_ctx() || capable(cap);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 1281c42a3456..69c92fad0a32 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -899,6 +899,27 @@ bool netlink_net_capable(const struct sk_buff *skb, int cap)
 }
 EXPORT_SYMBOL(netlink_net_capable);
 
+/**
+ * netlink_net_may - net_may() for a request that came in by netlink
+ * @skb:   socket buffer holding a netlink command from userspace
+ * @net:   the network namespace that the command is about
+ * @right: what the command wants to do to it
+ *
+ * As for netlink_ns_capable(), it takes both whoever opened the socket and whoever
+ * sent the message.
+ *
+ * Return: true if both may.
+ */
+bool netlink_net_may(const struct sk_buff *skb, const struct net *net, enum net_right right)
+{
+	const struct netlink_skb_parms *nsp = &NETLINK_CB(skb);
+
+	return ((nsp->flags & NETLINK_SKB_DST) ||
+		file_net_may(nsp->sk->sk_socket->file, net, right)) &&
+		net_may(net, right);
+}
+EXPORT_SYMBOL(netlink_net_may);
+
 static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
 {
 	return (nl_table[sock->sk->sk_protocol].flags & flag) ||

-- 
2.55.0